URLs which contain password is leaked in debug logs. - Githubissues

logstash-plugins / logstash-input-http_poller

Create Logstash events by polling HTTP endpoints!

https://www.elastic.co/guide/en/logstash/current/plugins-inputs-http_poller.html

Apache License 2.0

43 stars 65 forks source link

URLs which contain password is leaked in debug logs. #137

Open mashhurs opened 1 year ago

mashhurs commented 1 year ago

Issue description

There are mainly two issues with the plugin:

When Logstash registers the plugin with its configs, configs which contain passwords (in this case urls) are seen in the debug logs.
when preparing requests, we are logging in the logic which password is leaked. Details: https://github.com/logstash-plugins/logstash-input-http_poller/issues/81

Expectation

URLs should be in a way of securing the sensitive data so that it shouldn't allow sensitive data to print.